Allow disabling access to the DB and the Teams API.

Command-line options --nodatabaseaccess and --noteamsapi disable all
teams api interaction and access to the Postgres database. This is
useful for debugging purposes when the operator runs out of cluster
(with --outofcluster flag).

The same effect can be achieved by setting enable_db_access and/or
enable_teams_api to false.

cmd/main.go

@@ -19,12 +19,16 @@ var (
 	podNamespace   string
 	configMapName  spec.NamespacedName
 	OutOfCluster   bool
+	noTeamsAPI bool
+	noDBAccess bool
 	version        string
 )
 
 func init() {
 	flag.StringVar(&KubeConfigFile, "kubeconfig", "", "Path to kubeconfig file with authorization and master location information.")
 	flag.BoolVar(&OutOfCluster, "outofcluster", false, "Whether the operator runs in- our outside of the Kubernetes cluster.")
+	flag.BoolVar(&noDBAccess, "nodatabaseaccess", false, "Disable all access to the database from the operator side.")
+	flag.BoolVar(&noTeamsAPI, "noteamsapi", false, "Disable all access to the teams API")
 	flag.Parse()
 
 	podNamespace = os.Getenv("MY_POD_NAMESPACE")
@@ -87,6 +91,12 @@ func main() {
 	if configMapData["namespace"] == "" { // Namespace in ConfigMap has priority over env var
 		configMapData["namespace"] = podNamespace
 	}
+	if noDBAccess {
+		configMapData["enable_db_access"] = "false"
+	}
+	if noTeamsAPI {
+		configMapData["enable_teams_api"] = "false"
+	}
 	cfg := config.NewFromMap(configMapData)
 
 	log.Printf("Config: %s", cfg.MustMarshal())

pkg/cluster/cluster.go

@@ -227,19 +227,21 @@ func (c *Cluster) Create(stopCh <-chan struct{}) error {
 	}
 	c.logger.Infof("Pods are ready")
 
-	if !c.masterLess {
+	if !(c.masterLess || c.DatabaseAccessDisabled()) {
-		if err = c.initDbConn(); err != nil {
+		if err := c.initDbConn(); err != nil {
 			return fmt.Errorf("Can't init db connection: %s", err)
-		}
+		} else {
-
 			if err = c.createUsers(); err != nil {
 				return fmt.Errorf("Can't create users: %s", err)
 			} else {
 				c.logger.Infof("Users have been successfully created")
 			}
+		}
 	} else {
+		if c.masterLess {
 			c.logger.Warnln("Cluster is masterless")
 		}
+	}
 
 	c.ListResources()
 

pkg/cluster/pg.go

@@ -32,9 +32,13 @@ func (c *Cluster) pgConnectionString() string {
 		strings.Replace(password, "$", "\\$", -1))
 }
 
-func (c *Cluster) initDbConn() error {
+func (c *Cluster) DatabaseAccessDisabled() bool {
-	//TODO: concurrent safe?
+	if c.OpConfig.EnableDBAccess == false {
-	if c.pgDb == nil {
+		c.logger.Debugf("Database access is disabled")
+	}
+	return c.OpConfig.EnableDBAccess == false
+}
+func (c *Cluster) initDbConn() (err error) {
 	if c.pgDb == nil {
 			conn, err := sql.Open("postgres", c.pgConnectionString())
 			if err != nil {
@@ -48,7 +52,6 @@ func (c *Cluster) initDbConn() error {
 
 			c.pgDb = conn
 	}
-	}
 
 	return nil
 }

pkg/cluster/sync.go

@@ -36,6 +36,9 @@ func (c *Cluster) SyncCluster(stopCh <-chan struct{}) {
 	if err := c.syncStatefulSet(); err != nil {
 		c.logger.Errorf("Can't sync StatefulSets: %s", err)
 	}
+	if c.DatabaseAccessDisabled() {
+		return
+	}
 	if err := c.initDbConn(); err != nil {
 		c.logger.Errorf("Can't init db connection: %s", err)
 	} else {

pkg/controller/controller.go

@@ -50,7 +50,7 @@ func New(controllerConfig *Config, operatorConfig *config.Config) *Controller {
 		logger.Level = logrus.DebugLevel
 	}
 
-	controllerConfig.TeamsAPIClient = teams.NewTeamsAPI(operatorConfig.TeamsAPIUrl, logger)
+	controllerConfig.TeamsAPIClient = teams.NewTeamsAPI(operatorConfig.TeamsAPIUrl, logger, operatorConfig.EnableTeamsAPI)
 	return &Controller{
 		Config:   *controllerConfig,
 		opConfig: operatorConfig,

pkg/util/config/config.go

@@ -52,6 +52,8 @@ type Config struct {
 	WALES3Bucket       string `name:"wal_s3_bucket"`
 	KubeIAMRole        string `name:"kube_iam_role"`
 	DebugLogging       bool   `name:"debug_logging" default:"false"`
+	EnableDBAccess	   bool   `name:"enable_db_access" default:"true"`
+	EnableTeamsAPI     bool   `name:"enable_teams_api" default:"true"`
 	DNSNameFormat      string `name:"dns_name_format" default:"%s.%s.%s"`
 	Workers            uint32 `name:"workers" default:"4"`
 }

pkg/util/teams/teams.go

@@ -42,13 +42,15 @@ type TeamsAPI struct {
 	httpClient         *http.Client
 	logger             *logrus.Entry
 	RefreshTokenAction func() (string, error)
+	enabled bool
 }
 
-func NewTeamsAPI(url string, log *logrus.Logger) *TeamsAPI {
+func NewTeamsAPI(url string, log *logrus.Logger, enabled bool) *TeamsAPI {
 	t := TeamsAPI{
 		url:        strings.TrimRight(url, "/"),
 		httpClient: &http.Client{},
 		logger:     log.WithField("pkg", "teamsapi"),
+		enabled: enabled,
 	}
 
 	return &t
@@ -56,6 +58,10 @@ func NewTeamsAPI(url string, log *logrus.Logger) *TeamsAPI {
 
 func (t *TeamsAPI) TeamInfo(teamId string) (*Team, error) {
 	// TODO: avoid getting a new token on every call to the Teams API.
+	if !t.enabled {
+		t.logger.Debug("Team API is disabled, returning empty list of members")
+		return &Team{}, nil
+	}
 	token, err := t.RefreshTokenAction()
 	if err != nil {
 		return nil, err